CVE-2024-47814: use-after-free when closing buffers in Vim
Last updated 27 November 2024
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
use-after-free when closing buffers in Vim
— Microsoft
Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user must have intentionally set up such a strange auto command and run some buffer unload commands. However this may lead to a crash. This issue has been addressed in version 9.1.0764 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
— Debian
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47814?
CVE-2024-47814 has a severity rating that indicates it can lead to potential security risks depending on the configuration and usage of the affected software.
Which versions of Vim are affected by CVE-2024-47814?
CVE-2024-47814 affects Vim versions up to 2:9.1.0861-1, including versions 2:8.2.2434-3+deb11u1 and 2:9.0.1378-2.
How do I fix CVE-2024-47814?
To fix CVE-2024-47814, update Vim to the latest version that is not vulnerable.
Is CVE-2024-47814 a zero-day vulnerability?
CVE-2024-47814 is not classified as a zero-day vulnerability since it has been publicly disclosed.
What types of risks does CVE-2024-47814 pose?
CVE-2024-47814 may allow attackers to exploit vulnerabilities in Vim, potentially leading to unauthorized access or code execution.